Re: [TLS] PSK in 1.3?

[Hauke Mehrtens <[e-mail]>]

On 10/19/2014 03:03 PM, Yoav Nir wrote:
> As Ilari said, there are ciphersuites with PSK and FS. 
> 
> I don’t see what the rationale can be to allow non-PFS for PSK authentication, but prohibit it for certificate authentication.  That would imply that we can make a blanket statement that the data passed in PSK-authenticated sessions is inherently low-value or non-private.  I don’t think we can make that statement.

For using PFS some asymmetric cryptography is needed in addition to the
symmetric cryptography and without PFS only symmetric cryptography is
needed. For normal desktop usage this does not matter, but when you want
to use TLS and DTLS on some embedded devices like Class 1 node (see
rfc7228 section 3.) with ~ 10 KiB ram and ~ 100 KiB flash and a slow CPU
(~ 10MHz) without any hardware cryptography support a DTLS handshake
without PFS is possible in under two seconds while doing a handshake
with PFS with asymmetric cryptography like ECC would take more than 10
seconds or even minutes.
In addition adding ECC also adds some more code.

I tried a DTLS handshake between two simulated MSP430X and it took 3.3
seconds for the PSK handshake using TLS_PSK_WITH_AES_128_CCM_8 and it
took 336 seconds for a handshake using the
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 cipher suite on the curve secp256r1
without client authentication and 499 seconds with client
authentication. The slow part was the elliptic curve multiplication
which took 47 seconds. (my code was not very optimized and this was a
very slow CPU)

Hauke